tcp should not be forced in the krb5.conf file. The library should take care for a retry with TCP in case KRB5KRB_ERR_RESPONSE_TOO_BIG is received, maybe 9 years ago this was not handled right yet. Can you confirm that this is not an issue anymore for your these days?